S Cybersecurity · AI security · Subscription software · Growth stock · Thesis updated July 12, 2026

Profit proof, but growth is slowing

Q1 FY27 revenue grew 21% to $276.7 million, while ARR grew 23% to $1.1626 billion.
SentinelOne reached its first non-GAAP profit this quarter, a key proof point for the margin story.
Non-endpoint products, including Cloud, Data, and AI, approached 50% of total ARR mix.
Large customers are still growing, but customers with ARR of $100,000 or more rose only 17% year over year.
The 8% workforce reduction should help costs, but it also raises execution and demand questions.

01 Running thesis

Margins finally matter

SentinelOne is trying to prove it can be more than a fast-growing endpoint security company. Q1 FY27 gave investors a real milestone: the company reported its first non-GAAP profit. That matters because software companies can look strong on revenue but still burn too much money.

The better part of the story is the platform shift. Non-endpoint ARR, meaning recurring revenue from Cloud, Data, and AI products, approached 50% of total ARR mix. That suggests customers are buying more than the original endpoint product, which can widen the market and reduce reliance on one crowded category.

The hard part is growth. Revenue grew 21% year over year in Q1 FY27, and customers with ARR of $100,000 or more grew 17%. Those are still healthy numbers, but they show clear slowing from earlier years.

The 8% workforce reduction cuts both ways. It should save about $45 million a year, but it could also point to a tougher demand setup. The stock needs proof that SentinelOne can keep sales and product speed intact while moving closer to GAAP profitability.

May 2026→Q1 FY27 showed the key trade-off. SentinelOne reached non-GAAP profit and non-endpoint ARR approached 50% of mix, but revenue growth slowed to 21% and the company announced an 8% workforce reduction.

Mar 2026→FY2026 confirmed operating leverage, including full-year non-GAAP operating profitability, while revenue and ARR growth slowed to 22%. The Israeli tax dispute was settled, removing uncertainty but adding cash payment pressure.

Dec 2025→Q3 FY2026 kept the profit story alive with positive non-GAAP operating income. Growth kept cooling, with ARR up 23% and customers with ARR of $100,000 or more up 20%.

Aug 2025▲Q2 FY2026 delivered positive non-GAAP operating income, a sign that the model can scale. Revenue growth of 22% still showed the slowdown was not over.

May 2025▼Q1 FY2026 added a tax overhang tied to transfer pricing matters, while revenue and ARR growth slowed. Positive operating cash flow helped, but the GAAP net loss widened.

Mar 2025▲FY2025 marked the first full year of positive operating cash flow. The improvement strengthened the path-to-profitability case, even as revenue growth slowed and net retention fell.

Dec 2024▲Q3 FY2025 showed positive operating cash flow for the nine-month period. Revenue and ARR growth were still slowing, but the cash flow inflection made the story more balanced.

02 Business model

Subscriptions sold through partners

SentinelOne makes most of its money from subscriptions to the Singularity Platform. Customers usually pay by agent, which can mean an endpoint, server, or container. The main tiers are Singularity Core, Control, and Complete.

The company uses a land-and-expand model. It wins a customer, then tries to sell more modules, higher tiers, and newer products over time. This works best when customers add cloud, data, identity, and AI security tools on top of endpoint protection.

A large partner network helps sell the product. Resellers, distributors, and managed security service providers bring SentinelOne into more accounts. That helps reach, but it also means partner execution can affect sales timing.

Where this breaks is simple: if customers delay security spending, choose a larger bundle from a rival, or stop adding modules, ARR growth slows. That is why net retention, large-customer growth, and non-endpoint ARR are the key watch items.

03 Product portfolio

From endpoint to platform

Cash cow

Endpoint Protection and Response

This is the core product area. It protects laptops, desktops, servers, and other devices, then helps security teams detect and respond to attacks.

Steady

Singularity Platform

The main platform connects data from endpoints, cloud workloads, and other systems. It uses AI to spot threats and help automate response.

Growth engine

Cloud Security and CNAPP

SentinelOne expanded cloud security through its PingSafe acquisition. This gives customers broader coverage for cloud workloads, cloud posture, and application risks.

Growth engine

Purple AI

Purple AI brings generative AI into threat hunting and security operations. Management said AI security ARR nearly doubled sequentially in Q1 FY27.

Option

AI Runtime Security

The Prompt Security acquisition added tools to protect enterprise AI systems while they run. This is a newer market, so adoption is promising but still needs proof.

Option

Data Pipeline Management

The Observo AI acquisition added data pipeline technology for security data. If customers need to control security data costs and quality, this could become a useful add-on.

04 Business segments

One segment, global revenue

United States revenue61%modest

International revenue39%modest

SentinelOne reports one operating segment. For Q1 FY27, revenue outside the U.S. was 39%, so the mix below shows revenue by geography, not separate business units.

05 Risk factors

What could break

Growth keeps slowing

High impact · Medium odds

Revenue grew 21% year over year in Q1 FY27, and large customers grew 17%. If those rates keep falling, the platform story may not be enough to support the stock. Slower growth would also make the valuation harder to defend.

We watchQuarterly revenue growth, ARR growth, and customers with ARR of $100,000 or more.

Restructuring disrupts execution

High impact · Medium odds

The company announced an 8% workforce reduction to save about $45 million a year. Cost savings help margins, but layoffs can hurt morale, sales focus, and product speed. Q2 FY27 will also include an expected restructuring charge of about $25 million.

We watchSales productivity, hiring commentary, product release pace, and whether ARR growth holds after the cuts.

GAAP losses last too long

High impact · Medium odds

SentinelOne has a history of net losses even as non-GAAP profit improves. Investors need a clear path from adjusted profit to real GAAP profitability. Stock-based compensation, restructuring costs, and tax payments can slow that path.

We watchGAAP operating loss, free cash flow margin, stock-based compensation, and management's timeline for GAAP profitability.

Platform expansion stalls

Medium impact · Medium odds

Cloud, Data, and AI products approached 50% of total ARR mix, which is central to the bull case. If customers buy only the core endpoint product, SentinelOne remains more exposed to price pressure in a crowded market. The newer products must keep growing fast enough to lift the whole company.

We watchNon-endpoint ARR mix, AI security ARR growth, and customer adoption of Cloud, Data, and AI modules.

AI products create new risk

Medium impact · Medium odds

Generative AI can help security teams, but it can also give flawed results or depend on third-party models. Rules for AI are still changing. A serious error in an AI security workflow could damage trust.

We watchDisclosures about AI model issues, customer incidents, regulatory changes, and product liability language.

Channel or enterprise deal delays

Medium impact · Medium odds

SentinelOne depends on channel partners and large enterprise deals. These deals can take time and may slip between quarters. A weaker IT spending environment could make customers delay renewals or expansions.

We watchManagement comments on sales cycles, partner performance, large deal timing, and dollar-based net retention.

06 Quick answers

In one breath

How does SentinelOne make money?

SentinelOne sells subscriptions to its Singularity cybersecurity platform. Customers usually pay per agent, and SentinelOne tries to grow each account by selling more modules over time.

Is SentinelOne profitable?

SentinelOne reported its first non-GAAP profit in Q1 FY27. It still has to prove it can reach and sustain GAAP profitability, which includes more real-world costs.

Why is non-endpoint ARR important?

Non-endpoint ARR shows how much revenue comes from products beyond the original endpoint security base. In Q1 FY27, Cloud, Data, and AI products approached 50% of total ARR mix, which supports the platform thesis.

What is the biggest debate for SentinelOne stock?

The debate is growth versus profit. Bulls see better margins and a broader platform, while bears see slower revenue growth, slower large-customer growth, and risk from the workforce reduction.